Privacy Policy & Terms of Use

Contents

1. Who We Are

Mahaveer Cancer Care Foundation (MCCF) is a registered charitable trust operating "A New Hope" pharmacy at Esamia Bazaar, Hyderabad 500027. Trust Registration No.: [TRUST REG NO]. Drug Licence No.: [DRUG LICENCE NO].

MCCF is the Data Fiduciary for personal data collected through this website, the MCCF mobile app, WhatsApp communications, and pharmacy operations. Contact: info@mahaveercancercare.org.

This single policy covers both surfaces because they process largely the same patient data through the same backend — where the app collects something the website doesn't (camera, device location, push notifications, biometric app-lock), that is called out explicitly below rather than left to be assumed.

2. Data We Collect

We collect only what is needed to verify eligibility, dispense medicines safely, book diagnostics, and process payments and deliveries:

• Account & contact information: mobile number (used for OTP sign-in via AWS SNS), name, email, date of birth, gender — collected at registration or when you submit a form, WhatsApp, or email us.
• Government ID: Aadhaar or an alternate government ID (e.g. birth certificate), collected once for identity verification at KYC. We never store the ID number in plain text — see Section 6.
• Health information: your cancer diagnosis, uploaded prescriptions, prescribed medicines and dosages, diagnostic tests booked, and the treating doctor/hospital — shared by you or your caregiver to process medicine orders and test bookings.
• Financial information: your declared annual family income and income-proof document (used only to calculate your medicine discount tier), and order/payment amounts. Card, UPI, and net-banking details are collected directly by our payment partner, Razorpay — MCCF never sees or stores them, only the resulting payment status and reference.
• Address: street address, city, state, PIN code — for medicine delivery and for matching you to nearby partner hospitals, pharmacies, and diagnostic labs.
• Guardian details: for minors or dependants — guardian's name, relationship, and mobile number.
• Documents & photos: scans or photos you upload for KYC, income proof, and prescriptions.
• Donation information: name, transaction reference, and amount — for issuing receipts and 80G certificates.
• Website analytics: anonymised usage data via Google Analytics 4 on the website (page views, device type, geography) — no personally identifiable information.

3. App Permissions

The mobile app asks for the following on your device, only at the point it's needed — never all at once. Review or revoke any of them any time in your device's Settings → Apps → MCCF → Permissions.

• Camera & photos: photographing or choosing an existing photo/PDF of a prescription, ID, or income document, and saving/sharing generated PDFs (receipts, discount cards).
• Location (approximate & precise): finding partner pharmacies, hospitals, and diagnostic labs near you.
• Notifications: order, prescription-approval, and appointment updates, delivered through Expo's push infrastructure.
• Biometric / fingerprint: locking the app with your device's fingerprint or face unlock instead of a password. Your biometric data is processed and stored entirely on your device — the app only asks the operating system whether it matched, and MCCF's servers never receive or store the scan itself.
• Microphone: only requested if you use an in-app voice or video feature; the app does not record audio in the background.

A small number of permissions in our Android build are added automatically by libraries we use (for example, activity-recognition and system-alert permissions bundled with push-notification and analytics tooling) and are not actively used by any MCCF feature. We review these before every release and remove any we don't need.

The app also uses Sentry (crash and error diagnostics) and PostHog (in-app product analytics) — device model, OS version, crash logs, and screens/actions used, collected to keep the app reliable and to see which features are actually used. Neither receives your health or financial data.

4. How We Use Your Data

• To verify your identity, medical need, and income level, and calculate the right medicine discount.
• To process prescriptions, medicine and diagnostic-test orders, and coordinate pickup or home delivery.
• To record order amounts and payment status; the actual transaction is routed through Razorpay.
• To send order, verification, and appointment updates by push notification, SMS, or WhatsApp.
• To detect fraudulent sign-ups, duplicate accounts, and suspicious login activity.
• To diagnose crashes and bugs and understand which app features are used, in aggregate.
• To issue donation receipts and 80G certificates, and send quarterly anonymised impact reports to donors who request them.
• We do not use your health or financial data for advertising, and we do not sell your personal data to anyone, under any circumstances. We do not use your personal data for marketing unless you have explicitly opted in.

5. Data Sharing

MCCF does not sell, rent, or share your personal data with third parties for commercial purposes. Data is shared only with:

• Partner hospitals & doctors — prescription details, diagnosis, treating-doctor name, to confirm and verify prescriptions.
• Partner pharmacies & diagnostic labs — order, prescription, and test-booking details needed to dispense medicines or conduct tests.
• Courier / delivery partners — name, address, phone number, solely to facilitate medicine delivery.
• Razorpay — order amount and contact details, to process payments. Never your card/UPI credentials.
• Cloud infrastructure (AWS S3, AWS SNS) — encrypted document storage and SMS/OTP delivery.
• Sentry and PostHog — device and usage diagnostics only, as described in Section 3.
• Legal and regulatory authorities — if required by law (e.g., CDSCO, Income Tax Department for 80G records).

No data is shared with pharmaceutical companies, advertisers, or data brokers.

6. Patient Data & DPDP Act 2023

MCCF is committed to compliance with the Digital Personal Data Protection Act 2023 (India).

• Consent: personal data collected for medicine orders is processed with the explicit consent of the data principal (patient or their authorised caregiver).
• Purpose limitation: patient data is used solely for medicine dispensing and follow-up. It is not used for research, marketing, or shared with any third party without explicit consent.
• Health & identity data: health-related data and government ID are treated as sensitive personal data — encrypted at rest (AES-256-GCM for identity fields; Aadhaar is stored only as a one-way hash, never in plain text) and stored with restricted, role-based access.
• Children's data: where the patient is a minor, their profile is created and managed by a parent or legal guardian — see Section 11.
• Patient stories: all patient testimonials and stories published on this website are anonymised. No names, photographs, or identifying details are published without written consent, reviewed by our compliance process before publication.

7. Your Rights

Under the DPDP Act 2023, you have the right to:

• Access: request a summary of personal data we hold about you.
• Correction: request correction of inaccurate data.
• Erasure: request deletion of your personal data where we have no legal obligation to retain it — see Section 8.
• Withdraw consent for a specific use (e.g. push notifications) at any time.
• Grievance redressal: lodge a complaint if you believe your data rights have been violated; we respond within 30 days. Unresolved grievances may be escalated to the Data Protection Board of India once it is operational.

To exercise any right, email info@mahaveercancercare.org with subject line "Data Rights Request", including your registered mobile number so we can verify it's you.

8. Deleting Your Account

You can request permanent deletion of your MCCF account and personal data at any time, whether or not you have the app installed:

• On our website: visit our Account Deletion page — no sign-in required, just your registered mobile number and a one-time code.
• In the app: Profile → Settings → Delete Account.
• By email: info@mahaveercancercare.org, subject "Delete My Account", from your registered contact details.

Once verified, we anonymise your profile, health, and identity data immediately and revoke every active session, except records we are legally required to retain — see Section 10 — which are kept only for that period and then deleted. This action is permanent and cannot be undone.

9. Cookies

This website uses essential cookies required for navigation and Google Analytics 4 for anonymised usage analytics. We do not use advertising, tracking, or third-party marketing cookies. You may disable analytics cookies via your browser settings without affecting website functionality. The mobile app does not use cookies; see Section 3 for its equivalent analytics/crash-reporting tools.

10. Data Retention

• Prescription & medicine order records: retained for 7 years, as required under the Drugs and Cosmetics Act 1940.
• Donation records: retained for 10 years, as required for 80G compliance and audit purposes.
• General enquiry contact data: retained for 2 years, then deleted.
• Crash & analytics data (app): retained up to 12 months, then aggregated or deleted.
• WhatsApp communications: retained on WhatsApp Business platform per WhatsApp's own retention policies.

11. Children & Dependants

MCCF supports paediatric cancer patients. Where the patient is a minor, their profile is created and managed by a parent or legal guardian, whose name, relationship, and contact number are recorded alongside the patient's. We do not knowingly allow a minor to create or operate an account unsupervised. If you believe a child's data has been submitted without appropriate guardian involvement, contact us and we will act promptly.

---

Terms of Use

Medical Disclaimer

The information on this website and app is provided for informational purposes only. MCCF does not make any curative claims. Nothing here constitutes medical advice. Always consult a qualified oncologist or medical practitioner for diagnosis and treatment decisions.

MCCF does not prescribe, diagnose, or recommend specific treatment protocols. Medicine pricing information is indicative and subject to change. Confirm current prices with our pharmacy before placing an order.

Prescription Requirement

All Schedule H, H1, and prescription-only cancer medicines require a valid prescription from a registered medical practitioner. MCCF will not dispense prescription medicines without a valid prescription — this is a legal requirement under the Drugs and Cosmetics Act 1940 and Rules thereunder.

No Warranties

This website and app are provided "as is." MCCF makes no warranty that they will be uninterrupted, error-free, or free from viruses. Price information is updated periodically but may not reflect real-time stock or pricing changes.

Intellectual Property

All content on this website and app — including text, logos, graphics, and the "A New Hope" brand — is the property of Mahaveer Cancer Care Foundation. Content may not be reproduced for commercial purposes without written permission.

Governing Law

These terms are governed by the laws of India. Any disputes shall be subject to the exclusive jurisdiction of courts in Hyderabad, Telangana.

13. Contact for Privacy & Legal

Mahaveer Cancer Care Foundation
A New Hope Pharmacy, Esamia Bazaar, Hyderabad 500027
Email: info@mahaveercancercare.org
WhatsApp: +91 XXXXXXXXXX
Trust Reg. No.: [TRUST REG NO]
App: Delete your account